1

I have been running several LAMP servers for 5+ years with Let's Encrypt certs. Today, I did the SSL test by Qualys https://www.ssllabs.com/ssltest/index.html to learn that I had lost my coveted A+ because the ever-evolving cipher-suites list had changed and now I had weak cipher suites in use. Searching the internet will bring you to myriad websites, each with differing answers based on age. I love the simplicity of SSLCipherSuite HIGH:!aNULL:!MD5, this setting results in more weak ciphers, not less. Before I go the trial-and-error process of testing each one in isolation, is there a better way?

Question:

  • Is there key word like HIGH:!aNULL:!MD5 that will stand in for the best and strongest ciphers? And work long-term?
  • Or is there a website that is currently stays updated with the latest and greatest SSLCipherSuite recommendation?

PS Here is the list that months ago resulted in an A+

SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

Here are the test results as of November 2022 enter image description here

Improve this question
2
  • Note that the meaning of HIGH depends on the openssl version you are using. So you also need to update your system regularly (which you should do anyway). Apart from that this tool from mozilla provides for many years already help to configure your ssl settings properly. Regularly check what it recommends.
    – Steffen Ullrich
    Nov 11, 2022 at 22:50
  • "DES-CBC3-SHA" in cipher list for A+ a few month ago? That was probably only the case since the openssl you are using no longer had this cipher compiled in and thus enabling it did nothing.
    – Steffen Ullrich
    Nov 11, 2022 at 22:55

1 Answer 1

Reset to default
1

I would suggest the Mozilla Server Side TLS recommendations, as well as the associated config generator as a baseline for most purposes.

What I particularly like is their three proposed configurations for different tradeoffs of legacy compatibility (in a security conscious manner) vs most up to date (taking full advantage of more recent standards), presented with the rationale for the various decisions.
The "intermediate" option in particular tends to be a great middle ground.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .